Dirty Money: 'The Wolf of Wall Street' and the Laundered Billions
The 1MDB Billions, 'The Wolf of Wall Street', and the International Law Mechanism That Missed it All
“…this is a case where life imitated art,” announced United States Assistant Attorney General Leslie Caldwell at a Department of Justice press conference on 20 July 2016. She was referring to The Wolf of Wall Street — Martin Scorsese’s 2013 film about a fraudulent stockbroker who hid stolen money in offshore accounts. What Caldwell was describing was 1Malaysia Development Berhad (1MDB) — a Malaysian sovereign wealth fund through which, according to DOJ civil forfeiture complaints filed that same day, more than USD 3.5 billion in public funds had been systematically looted between 2009 and 2015, laundered across four international jurisdictions and — in a piece of structural irony almost too neat to believe — used in part to finance the film itself.
A movie about hiding illicit profits in a perceived foreign safe haven, produced with illicit profits hidden in a perceived foreign safe haven.
The fraud is extraordinary. But set it aside for a moment. What follows is about something more structural: the international mechanism that was supposed to catch exactly this kind of conduct — and why, by design, it never could. During the same years in which that money was moving, Malaysia was a state party in good standing to the United Nations Convention Against Corruption (UNCAC). Malaysia was actively participating in the treaty’s official monitoring system — a process where diplomat-experts audit each other’s anti-corruption laws. The bureaucratic machinery ran. The boxes were ticked.
It found nothing.
This is not a case of failed oversight. It is a case study in an architecture functioning precisely as intended: designed by the very states subject to it to avoid the conditions under which failure could ever be measured. The question is not why the apparatus missed 1MDB. The question is what, structurally, it was ever capable of finding.
The Convention and the Catch
UNCAC is the only legally binding global anti-corruption instrument. Adopted in 2003 and in force since 2005, it has been ratified by 190 states — near-universal participation. Its four pillars are prevention, criminalisation, international cooperation, and asset recovery. Ratification is not a signalling of good intentions; it is a binding legal obligation.
That obligation comes, as it turns out, almost entirely without teeth. No external authority can compel a state to comply, penalise one that does not, or independently verify whether obligations are being met. What UNCAC has instead is the Implementation Review Mechanism (IRM). Established in 2009 and operational since 2010, the IRM’s stated purpose is to assist states in implementing their obligations through a structured peer-review process.
The mechanism’s own language is worth a moment’s attention: it frames itself not as an auditor but as a partner in capacity building.
It is designed, in its own terms, to help states comply — not to determine whether they have done so.
That framing is not incidental. A mechanism that positions itself as a partner rather than an examiner has already made a structural choice about what it will and will not find.
The Audit, By the Audited
To understand why the IRM missed the scheme taking place, it helps to look at how it actually operates — not as it describes itself, but as it functions. Each element of the review process represents a structural choice. Line those choices up, and the pattern is either a remarkable series of coincidences or entirely by design.
The review is conducted by peers. Each state under review is assessed by two other governments — one from its own regional group and one from outside it. Reviewers are government-designated. This matters because every state in the room will eventually be the one under review. The structural interest is not in rigorous scrutiny. The interest is in a comfortable process that reflects well on everyone. Reciprocity is a powerful norm. Independent scrutiny is, in this context, nobody’s friend.
The primary input is self-assessment. The review opens with a questionnaire completed by the state under review. Reviewers work from this as their foundational document, with no obligation to cross-reference self-reported information against court records, investigative reporting, or the findings of international monitoring bodies. The reviewed state describes itself. Reviewers assess that description.
Site visits are optional and require consent. In-country visits — where reviewers observe implementation in practice rather than on paper — are the most consequential form of scrutiny available. They are also entirely voluntary. A state that has something to conceal may simply decline to host one. Most do, and the mechanism has no response to that beyond noting the absence.
Reports are confidential by default. The actual findings — the full review report — are published only if the reviewed state consents — an option that states with serious corruption concerns exercise freely, which is to say, they decline. What the public sees instead is an executive summary, a document into which the reviewed state has substantial input. The subject of the review edits the account of the review. If this sounds like the ending you already expected, that is because it is.
Civil society has no formal role. Non-governmental organisations, investigative bodies, and human rights monitors — the actors most likely to hold documented evidence of the gap between a state’s legal framework and its operational reality — have no formal standing in the process. They may submit information. Reviewers are not required to consider it. The people who most often know what is actually happening are formally peripheral to a process designed to find out what is actually happening.
Recommendations are not binding. The review concludes with recommendations carrying no compliance deadline, no follow-up enforcement, and no consequences for ignoring them entirely. They are, in the most precise sense of the word, suggestions.
Each of these features might be defended in isolation as pragmatic — a concession to state sovereignty, a recognition of resource constraints, a gesture toward cooperative monitoring. Together, they produce a closed system in which the information that would make accountability possible is systematically excluded, and the information that is included is provided by the party with the greatest interest in a favourable outcome.
The IRM is not a detection system. It is a certification system — and what it certifies is not compliance, but participation in the process of reporting compliance. The distinction between those two things is the black hole at the centre of the system: where accountability enters, and nothing escapes.
The Fund, the Film, and the Review
Between 2009 and 2015, more than USD 3.5 billion was misappropriated from 1MDB—a sovereign wealth fund established by the Malaysian government with a stated purpose of national economic development. Its actual purpose, according to DOJ civil forfeiture complaints, was to become the vehicle for one of the largest state-linked financial frauds in recorded history.
The advisory board was chaired by Prime Minister Najib Razak. Stated purpose met actual execution through a network of shell companies—entities designed to place layers of apparent legitimacy between stolen money and its destination—across Singapore, Switzerland, Luxembourg, and the United States.
The money reached a Manhattan penthouse, a Beverly Hills mansion, a private jet, Van Gogh and Monet paintings, and eleven wire transfers totalling USD 64 million directly to Red Granite Pictures, the Hollywood production company co-founded by Riza Aziz, the Prime Minister’s stepson. Red Granite produced The Wolf of Wall Street. The film — a story about a man who steals money, hides it offshore, and eludes accountability — grossed over USD 392 million worldwide. The producers were apparently familiar with the territory.
The central figure in the scheme’s financial architecture was Low Taek Jho — known as Jho Low — a Malaysian financier whose name runs throughout both the DOJ complaints and OCCRP’s extensive investigative archive. Jho Low has not been apprehended; he is reportedly living under an assumed identity in Shanghai. Najib was convicted of corruption by a Malaysian court in 2020 and is currently serving a twelve-year sentence.
Meanwhile, at the United Nations
Malaysia ratified UNCAC in 2008, one year before 1MDB was established. Between 2010 and 2015, under the IRM’s first review cycle, Malaysia’s anti-corruption and international cooperation frameworks were formally assessed — precisely the areas most relevant to the multi-jurisdictional money movement happening at the same time.
The review ran. Malaysia’s self-assessment was completed. The peer reviewers — government experts from Kenya and the Philippines — conducted their dialogue and produced their report. That report addressed Malaysia’s anti-corruption legal frameworks and international cooperation mechanisms in considerable detail. It does not mention 1MDB. By 2015, DOJ investigators and the Sarawak Report group had already begun documenting, through publicly available financial records and corporate filings, what those frameworks had failed to prevent. The information existed. The mechanism’s defined scope was pointed elsewhere.
Managing the Record
In 2015, Malaysia amended its Official Secrets Act to restrict domestic reporting on 1MDB. The Attorney-General investigating the fund, Abdul Gani Patail, was controversially removed and replaced. Editors were pressured. Publications were suspended.
A mechanism reliant on state self-reporting, excluding civil society, and making site visits contingent on consent cannot compensate for a state actively managing its own information landscape. This is not a criticism of individual reviewers — they worked within the system they were given. It is a description of what the system structurally permits — and in this case, what it permitted was everything.
The mechanism did not miss 1MDB because it looked in the wrong place. It missed 1MDB because its architecture only permitted it to look where the state had already agreed to be seen.
By Design
The States Wrote Their Own Review
The IRM was negotiated by the Conference of the States Parties to UNCAC — that is, by the states being reviewed, determining the terms of their own review. The decisions to make site visits optional, to anchor the process in self-assessment, to exclude civil society, to default to confidentiality, and to issue non-binding recommendations were not oversights. They were negotiated positions, agreed upon by governments whose interests lay in maintaining the performative functioning of an international anti-corruption framework while preserving maximum autonomy over its findings.
Consider each design choice in terms of who benefits. Optional site visits benefit states where the gap between legal framework and operational reality is widest. Confidential reporting benefits states that would suffer reputationally from published findings. Civil society exclusion benefits states whose compliance gaps are best documented by journalists and NGOs. Self-assessment benefits states that control their own information landscape. Peer review by fellow state parties benefits states whose peers share a structural interest in keeping the mechanism comfortable — because the mechanism reviews them all.
This is not a conspiracy. It is the ordinary logic of international treaty design: states negotiate the minimum accountability architecture necessary to ratify the instrument. The result, reliably, is an architecture that serves the states doing the negotiating.
Participation Is Not Compliance
This distinction matters beyond the 1MDB case. It is the structural logic of international self-regulatory frameworks more broadly — mechanisms in which the regulated parties negotiate the regulatory architecture, the information inputs, and the consequences of non-compliance. UNCAC is an extreme illustration, but it is not an anomaly. The same logic appears in voluntary corporate governance frameworks, industry self-regulation, and bilateral investment treaty arbitration systems, where states and investors jointly determine the rules governing disputes between them.
The 1MDB case is useful precisely because it is extreme — the scale of the fraud, the involvement of the head of government, the multi-jurisdictional money flows, the eventual criminal conviction of a sitting prime minister. All of this makes the gap between what was occurring and what the mechanism found impossible to attribute to bad luck or insufficient diligence. The gap is structural. And a structural gap of this kind does not close on its own.
It Functioned as Designed — and That Is the Problem
There is a phrase familiar to anyone who has watched an institution investigate itself: we looked into the matter and found no evidence of wrongdoing. It travels across industries and jurisdictions — from corporate audits to police complaints to parliamentary inquiries — and, after sufficient repetition, acquires an almost comedic reliability. The finding is always the same. The process is always described as thorough. The gap between the two is never explained.
The UNCAC Implementation Review Mechanism is the international community’s formal version of this arrangement. It exists. It operates. It produces reports, recommendations, and executive summaries. States participate. The process is followed. In this structural sense, it functions perfectly.
What it does not do is detect the misappropriation of USD 3.5 billion from a sovereign wealth fund by the officials responsible for it, during the review cycle covering the precise legal frameworks relevant to that conduct, in a state that participated throughout in good standing. It does not do this because it cannot — not as a matter of capacity, but as a matter of design. A mechanism that excludes independent verification, marginalises civil society, makes its most consequential elements conditional on state consent, and defaults to confidentiality will find what states choose to report. In Malaysia’s case, that was not 1MDB.
Leslie Caldwell was right that life imitated art. What neither she nor anyone else at that press conference observed was that the UN’s anti-corruption review had spent the intervening years certifying the canvas.
The IRM was not designed to fail. It was designed to avoid the conditions under which failure could be measured. That is a more precise and more damning description. Failure implies an attempt.
What the IRM offers instead is participation — the performance of accountability, conducted according to rules written by its subjects, producing findings that its subjects control, carrying consequences that its subjects can ignore.
The money moved. The review cycle ran. The mechanism found compliance.
Case closed.
All three outcomes were, structurally, entirely predictable.
Next in this series: Found It: Clare Rewcastle Brown and the 1MDB Billions
How one investigative journalist, a whistleblower, and a foreign Department of Justice uncovered what UNCAC’s review mechanism missed entirely. A case study in accountability when systems fail.
Sources
1MDB Investigation Archive: Jho Low, OCCRP (Landing Page, 2026)
1MDB Investigation Archive, Sarawak Report (Landing Page, 2025)
Caldwell, Leslie R, ‘Assistant Attorney General Leslie R Caldwell Delivers Remarks at Press Conference Announcing Significant Kleptocracy Enforcement Action to Recover More Than $1 Billion Obtained from Corruption Involving Malaysian Sovereign Wealth Fund’, United States Department of Justice (Speech, 20 July 2016)
COSP (Conference of the States Parties), UNODC (Landing Page)
Country Review Report of Malaysia, UNCAC Implementation Review Mechanism First Cycle (Report, UNODC, 2015)
Dzulkifly, Danial, ‘Najib Sacked Muhyiddin for Questioning 1MDB, Gani Patail for Loss of Trust, says ex-Govt Chief Sec’, Malay Mail (Article, 19 November 2019)
Gilfillan, Corinna, The Way Forward: Ensuring an Inclusive, Transparent and Effective UNCAC Implementation Review Mechanism, UNCAC Coalition (Report, September 2022)
‘Jho Low Reportedly Hiding in Shanghai Luxury Mansion, say Journalists’, The Straits Times (Article, 19 July 2025)
Implementation Review Mechanism, UNODC (Landing Page)
‘1MDB scandal: Malaysia PM Najib Razak Sacks Deputy, Attorney-General as Corruption Allegations Mount’, ABC (Article, 29 July 2015)
‘Malaysian Editors Charged with ‘Intent to Annoy’ after Reporting on 1MDB’, The Guardian (Article, 27 February 2016)
The Wolf of Wall Street, Box Office Mojo by IMDbPro (Landing Page)
UNCAC Review Mechanism: Up and Running But Urgently Needing Improvement, Transparency International (Article, 12 November 2013)
‘United States Seeks to Recover More Than $1 Billion Obtained from Corruption Involving Malaysian Sovereign Wealth Fund’, United States Department of Justice (Press Release, 20 July 2016)
UNCAC Review Status Tracker, UNCAC Coalition (Report, 5 December 2024)
United Nations Convention Against Corruption, opened for signature 9 December 2003, 2349 UNTS 41 (entered into force 14 December 2005)
United States v 'The Wolf of Wall Street' Motion Picture, No 2:16-cv-05362 DSF(PLAx) (United States District Court, Central District of California, filed 20 July 2016)
Zhu, Melissa, ‘Najib Razak: Malaysia’s ex-PM Starts Jail Term after Final Appeal Fails’, BBC (Article, 23 August 2022)
 | A guest post by
|